Repository navigation
ci: enforce three mandatory package quality gates - #4126
Conversation
Greptile SummaryThe PR establishes three aggregate CI quality gates and reuses a single SHA-addressed npm artifact across compatibility and release validation.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/cicd.yml | Defines the three aggregate quality gates, canonical-artifact reuse, registry validation, and gated downstream dispatch flow. |
| scripts/ci/npm-compatibility-artifact.ts | Implements packing, manifest hashing, verification, and materialization of the canonical npm artifact. |
| scripts/ci/registry-release-integrity.ts | Implements exact-version registry metadata, provenance, package, API, and page integrity checks. |
| scripts/test/runtime-inference-critical-flow.ts | Runs critical runtime flows against the packed canonical artifact across supported runtimes. |
| tests/integration/ci/merge-quality-gate-workflow.test.ts | Verifies the merge gate dependency and fail-closed workflow contract; its testing helpers now use the required facades. |
| tests/integration/ci/npm-compatibility-artifact-workflow.test.ts | Verifies canonical-artifact production, reuse, and aggregate artifact-gate behavior. |
| tests/integration/ci/registry-release-workflow.test.ts | Verifies registry-gate selection and downstream deployment ordering. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
S[Source and test jobs] --> M[quality gate merge]
B[Build and pack canonical npm artifact] --> N[npm install smoke]
B --> R[Deno Node and Bun critical flows]
N --> A[quality gate artifact]
R --> A
A --> P[Publish selected release]
P --> V[Exact registry validation]
V --> G[quality gate registry]
G --> D[Downstream deployment dispatches]
Reviews (10): Last reviewed commit: "Keep release hardening checks aligned wi..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38a52df210
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
📦 Client bundle boundary
A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Addressed the three review findings in |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
kwakayama
left a comment
kwakayama
left a comment
There was a problem hiding this comment.
Codex scored review
Reviewed SHA: 87cb2196026a4d4f14b278a47d2f1bf8f25b3bd3
No actionable findings. The quality-gate changes fix the reproducible npm pack destination failure by resolving the artifact path before package-local execution, and eliminate Sonar tainted-log findings by logging classification-only failure data. Focused CI/artifact suites (14 steps), touched-file format/lint/checks, and baseline audits pass; no unresolved review threads remain.
Score: 93/100
Verdict: APPROVE
Review-Gate:
Reviewer: Codex
Reviewed-SHA: 87cb219
Score: 93/100
Actionable-Findings: 0
Verdict: APPROVE
kwakayama
left a comment
kwakayama
left a comment
There was a problem hiding this comment.
Codex scored review
Reviewed SHA: 098c0dd0e4a4946365d26969db178b03cacb25af
No actionable findings. This follow-up tightens the registry quality-gate regressions by validating the package-local artifact, workflow-shape, registry-release, and merge-quality suites with direct test commands while preserving the production fixes from the prior commit. The exact head has zero unresolved threads; fresh CI is pending.
Score: 94/100
Verdict: APPROVE
Review-Gate:
Reviewer: Codex
Reviewed-SHA: 098c0dd
Score: 94/100
Actionable-Findings: 0
Verdict: APPROVE
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5804977525
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Exact head 7fb3189 reviewed. The RC compatibility artifact applies the same run-number version mutation before its gate, and registry failures preserve only sanitized package/version context. Focused workflow/registry suites pass (21 steps); CI TypeScript, format, and lint contracts pass. The local npm-pack test cannot run on this host because npm is unavailable; the GitHub Node jobs are running. @kojiwakayama please provide the required non-author approval on this exact head. |
|
@codex review |
|
@codex review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 523ff780a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
4a7dba7 to
3f0ca33
Compare
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Use [[ ]] in the new bash paths, add the explicit default case and function returns SonarCloud asks for, extract the nested ternaries and nested template literal, and split pollRegistryPackage's per-attempt lookup into a helper so its cognitive complexity drops under the limit. Also typecheck scripts/ci/publish-npm-packages.test.ts in lint:ci-typescript, which ran the suite but never type-checked it. No behaviour change.
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a766ad2687
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Fresh independent review of PR #4126 at exact head a766ad2. Code review: all three gates, artifact name/version/gitHead binding, RC lookup diagnostics, Sonar cleanup, coverage preservation, and release ordering verified. No actionable code findings. External GitHub branch-protection and production-environment approval settings remain unconfigured. Review-Gate: |
|
Fresh independent review of PR #4126 at exact head a766ad2. Code review found no actionable release-gate code defects. The score is held below the merge threshold only because the live GitHub settings do not yet require quality gate (merge) and quality gate (artifact), and production has no required reviewer approval. Review-Gate: |
There was a problem hiding this comment.
kwakayama has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
|
@codex review |
|
Fresh independent review of PR #4126 at exact head dcf2657. The full Node and Bun suites are now part of the merge gate. Registry/package identity, RC lookup diagnostics, Sonar cleanup, coverage, and dispatch ordering are sound. No blocking code findings. External branch protection and production environment approval settings remain unconfigured. Review-Gate: |
|
Fresh independent review of PR #4126 at exact head dcf2657. No actionable code defects remain. The only actionables are external: GitHub does not require quality gate (merge) or quality gate (artifact), and production has no required reviewer approval. Review-Gate: |
2 participants
Summary
.github/QUALITY_GATES.mdas the concise gate contract.Verification
deno task build:npmcompleted and produced 31 verified packages.Release behavior
The published npm version is immutable. If registry smoke fails, the release fails and downstream dispatches remain blocked; the recovery path is a corrected new version.
Reference
Implementation plan and triage brief: https://github.com/veryfront/veryfront-issue-inbox/issues/790
Known validation limitation: repository-wide
deno task fmt:checkhas a pre-existing formatting failure in untouchedscripts/test/run-suite.test.ts:102; the local pre-push suite also completed all tests with zero failures but exited on an existing pending-promise condition.Summary by CodeRabbit
New Features
Bug Fixes
Documentation